react2shell

React2Shell - CVE-2025-55182 Exploit PoC A proof-of-concept exploit for CVE-2025-55182, a critical Remote Code Execution vulnerability in Next.js applications using React Server Components. ⚠️ DISCLAIMER THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY. ❌ DO NOT use against system...

CVE-2024-4577

La herramienta de explotación más rápida para CVE-2024-4577 Descripción: Ejecución remota de código en PHP CGI La herramienta de explotación CVE-2024-4577 exploit.py es un script de Python diseñado para explotar una vulnerabilidad específica de los servidores web CVE-2024-4577. Basándose en el...

CVE-2024-39211

CVE-2024-39211 Kaiten User Enumeration Kaiten - a workflow management system, is vulnerable to unrestricted brute force attacks on user logins and email addresses registered in the system via a simple POST request. References: CVE MITRE Description NVD CVE Usage Simple download bash script and ru...

exploit-CVE-2020-24815

exploit-CVE-2020-24815.py este es mi primer exploit para CVE-2020-24815 pon la ruta POST después de la url !!!! Ejemplo: si el script no funciona cambia la cookie en el script $ - pip install -r requirements.txt arreglar problema pdftotext no instalado: $ - sudo apt-get install build-essential...

ffuf

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

CVE-2024-24919-Bulk-Scanner

Escáner Masivo CVE-2024-24919 CVE-2024-24919 Divulgación de Información de Check Point Security Gateway Script basado en y el crédito va para: https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/ Este script de Python escanea una lista de URLs en busca de la vulnerabilidad...

CVE-2023-28432

Explotación de vulnerabilidad en MinIO CVE-2023-28432 Descripción Este script en python3 está diseñado para explotar CVE-2023-28432, que potencialmente afecta a ciertas configuraciones del servidor MinIO. El script realiza una solicitud POST a un hostname especificado, intentando recuperar...

xsssniper

XSSSNIPER xsssniper is an handy xss discovery tool with mass scanning functionalities. Usage: Usage: xsssniper.py options Options: -h, --help show this help message and exit -u URL, --url=URL target URL --post try a post request to target url --data=POSTDATA post data to use --threads=THREADS...

CVE-2023-25194

Esta herramienta está destinada únicamente a fines de pruebas de seguridad. No realice actividades ilegales. Cualquier consecuencia derivada del mal uso es responsabilidad exclusiva suya. La herramienta de detección CVE-2023-25194 utiliza JNDI para cargar el contenido de respuesta devuelto por la...

CVE-2024-22939

objetivo:https://github.com/sunkaifei/FlyCms versión: v1.0 Se descubrió que FlyCms v1.0 contiene una Cross-Site Request Forgery CSRF a través del componente /system/article/categoryedit Poc history.pushState'', '', '/' Éxito:...

cve-2016-1555

Descripción El módulo aprovecha una vulnerabilidad de ejecución arbitraria de comandos sin autenticación en Netgear WN604 anterior a 3.3.3 y WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360 y WNDAP660 anterior a 3.5.5.0. La vulnerabilidad ocurre en cómo el router maneja las solicitudes POST desde...

SSI-CVE-2022-21661

SSI-CVE-2022-21661 Segunda tarea de Seguridad de Sistemas de Información Estudiar y explotar la vulnerabilidad CVE-2022-21661 que permite inyecciones SQL a través de peticiones POST de plugins en versiones de WordPress anteriores a la 5.8.3. Configurando el entorno Para iniciar y configurar el...

CVE-2024-40498

CVE-2024-40498 Aplicación afectada online-shopping-system-advanced 1.0 https://github.com/PuneethReddyHC/online-shopping-system-advanced Descripción El archivo register.php gestiona el registro de usuarios. En la línea 117, los parámetros POST "$address1" and $address2" no están sanitizados, a...

fortilogger_arbitrary_fileupload

CVE-2021-3378 | FortiLogger - 인증되지 않은 임의 파일 업로드 Metasploit 날짜: 30-01-2021 익스플로잇 작성자: Berkan Er [email protected] 공급업체 홈페이지: https://www.fortilogger.com/ 소프트웨어 링크: https://www.fortilogger.com/download 버전: 4.4.2.2 테스트 환경: Windows 10 Enterprise x64 CVE: 2021-3378 공개 날짜: 26-02-2021 이 모듈은 안전하지 않은...

TOTOLINK/Realtek Routers - CAPTCHA Bypass

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload "topicurl":"setting/getSanvas". This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted...

Mlflow - Cross-Site Scripting

The vulnerability allows an attacker to inject malicious code into the Content-Type header of a POST request, which is then reflected back to the user without proper sanitization or escaping. id: CVE-2023-6568 info: name: Mlflow - Cross-Site Scripting author: ritikchaddha severity: medium...

Alfresco Share - Open Redirect

Alfresco Share before 5.2.6, 6.0.N and 6.1.N contains an open redirect vulnerability via a crafted POST request. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2019-14223 info: name:...

SuperWebMailer 9.00.0.01710 - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 allowing XSS via crafted incorrect passwords. id: CVE-2023-38192 info: name: SuperWebMailer 9.00.0.01710 - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 allowi...

Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting

Keycloak 10.0.0 to 18.0.0 contains a cross-site scripting vulnerability via the client-registrations endpoint. On a POST request, the application does not sanitize an unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response i...

PuneethReddyHC action.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping through the /action.php prId parameter. Using a post request does not sanitize the user input. id: CVE-2021-41648 info: name: PuneethReddyHC action.php SQL Injection author: daffainfo severity: high descriptio...